Check a big file's checksum without uploading it.
HashCheckr reads the file straight from your disk and hashes it here, in the page. Nine algorithms, files of any size, and a verify field that shows you exactly which characters differ.
Drop files here
Any size, any number of them. You can also paste a file from the clipboard, or pick them yourself.
Check a whole manifest at once
Paste a SHA256SUMS file — or any output of sha256sum, md5sum, shasum or the BSD style “SHA256 (file) = hash”. Drop the files it lists into the window and every line is checked by name.
Nothing to check yet. Paste the SHA256SUMS file that came with your download.
Write a checksum file
One line per file, in the format GNU coreutils reads. Keep it next to your files and you can re-check the whole set later with a single command.
Drop files into the window first — the manifest lists whatever is loaded.
Hash a piece of text
The text is encoded as UTF-8 and hashed as you type. Turn on HMAC to authenticate it with a shared secret key instead.
›Files are read from your disk in 8 MB chunks and hashed by a Web Worker inside this page. Nothing is uploaded, no request leaves the browser, and nothing is stored — disconnect from the network and it still works.
why hashcheckr
Why HashCheckr
any size
Gigabytes without a stall
A 9 GB disk image is read in 8 MB slices inside a Web Worker, so the page keeps scrolling while it works. You get a live percentage, throughput in MB/s and an estimate of the time left — and a stop button that actually stops.
nine algorithms
One read, several digests
SHA-256, SHA-384, SHA-512, SHA3-256, BLAKE3, SHA-1, MD5, CRC32 and xxHash64. Tick as many as you need and the file is still read only once — every hasher is fed the same chunk as it goes past.
verification
Tells you what went wrong
Paste a bare digest, a whole sha256sum line or a SHA256 (file) = … block; the algorithm is worked out from the length. On a mismatch the differing characters are highlighted, so a mistyped checksum looks nothing like a corrupted download.
what this is
About HashCheckr
A checksum is the short fingerprint a hash function produces from a file. Change one byte anywhere inside a 5 GB ISO and roughly half the bits of its SHA-256 flip, which is exactly why download pages publish one: you recompute the hash on your own copy and compare. HashCheckr is a checksum calculator that does that comparison in the browser — drag in a file, pick SHA-256, SHA-512, BLAKE3, MD5 or any of the nine algorithms, and read the digest a moment later. Because the file is read through the browser's File API and hashed by WebAssembly in a worker thread, there is no upload step, no queue and no size limit beyond what your machine can read.
Verification is the part most tools do badly. Paste whatever the release page gave you — a bare hash, a sha256sum line, a SHA256: … label — and HashCheckr works out the algorithm from the digest length and answers with a plain verified or mismatch, highlighting the characters that differ so you can tell a truncated copy-paste from a genuinely different file. Whole sets are handled the same way: paste a SHA256SUMS manifest, drop the files it lists, and every line is checked by name. Going the other way, you can hash a folder of files and download a coreutils-compatible manifest to re-check them later with sha256sum -c.
guides
Guides & articles
What a checksum actually proves, which algorithms still hold up, and how to check a download yourself.
What is a checksum and why every download page shows one
The long hex string next to a download link is a summary of the file's contents that anyone can recompute. Here is what it proves, where it comes from, and the one thing it cannot tell you.
5 min read
SHA-256 vs SHA-1 vs MD5: which hashes are still safe in 2026
MD5 fell in 2004, SHA-1 in 2017 — but both are still printed on download pages. What broke, what it costs to break it today, and which algorithm belongs in which job.
6 min read
How to verify a download with a checksum on Windows, macOS and Linux
The exact commands for certutil, Get-FileHash, shasum and sha256sum, how to compare two digests without fooling yourself, and what a GPG signature adds on top.
6 min read
questions
Frequently asked questions
Are my files uploaded anywhere?
No. HashCheckr reads the file through the browser's File API, slices it into 8 MB chunks and feeds them to a WebAssembly hash function running in a Web Worker on your own machine. No byte of the file is sent anywhere, nothing is stored, and after the page has loaded it makes no network requests at all — you can disconnect from the internet and keep hashing.
Is there a maximum file size?
There is no limit built into HashCheckr. Because the file is streamed in 8 MB slices, memory use stays flat whether the file is 2 MB or 20 GB — the browser never has to hold the whole thing at once. In practice the ceiling is your disk: a 9 GB ISO on a fast NVMe drive takes well under a minute, the same file on a USB 2.0 stick takes several.
How fast is it compared with sha256sum in a terminal?
Close, but not equal. The WebAssembly build of SHA-256 typically reaches a few hundred MB/s on a modern laptop, while a native sha256sum with hardware SHA extensions can be two to four times quicker. BLAKE3 is the fastest option here if you only need the hash for your own bookkeeping. HashCheckr shows live throughput in MB/s while it works, so you can see what your machine is actually doing.
MD5 is broken — why is it still here?
Because plenty of software still publishes MD5 sums, and MD5 is perfectly good at the job of spotting an accidentally corrupted file. What it cannot do is prove that nobody tampered with the file on purpose: practical MD5 collisions have existed since 2004, and SHA-1 collisions since 2017. HashCheckr marks both as legacy and prints a warning when you select them, so the distinction stays visible.
How does the algorithm auto-detection work?
By digest length. A hex digest has a fixed size per algorithm — 8 characters for CRC32, 16 for xxHash64, 32 for MD5, 40 for SHA-1, 64 for SHA-256, 96 for SHA-384 and 128 for SHA-512 — so pasting any of them is enough to identify the family. 64 characters is ambiguous because SHA-256, SHA3-256 and BLAKE3 all produce that length; HashCheckr compares against whichever of the three it has already computed and offers a button for the others.
Which checksum file formats can it read and write?
It reads GNU coreutils output (<hash> <filename>, as produced by sha256sum, md5sum and shasum), the BSD form SHA256 (file) = <hash>, filename hash in the reverse order, bare digests and lines labelled SHA256:. Comment lines beginning with # are ignored. It writes the coreutils format, which you can check later with sha256sum -c SHA256SUMS.
What is the HMAC option for?
HMAC turns a hash into a keyed authentication code: without the secret key you cannot produce or check the result. It is what webhook providers use to sign their payloads, so you can paste a webhook body and its secret into the text tab and reproduce the signature they sent. HMAC needs a hash with a defined block size, so it is available for SHA-256, SHA-384, SHA-512, SHA3-256, SHA-1 and MD5, but not for BLAKE3, CRC32 or xxHash64.
Does it work on a phone?
Yes. The layout is built for narrow screens, the file picker opens your phone's file browser or photo library, and hashing runs in a Web Worker on iOS and Android just as it does on a desktop. Expect lower throughput and be aware that mobile browsers may suspend a background tab, which pauses a long hash until you return to the page.
Does a matching checksum mean the file is safe?
It means your copy is byte-for-byte identical to the file whose checksum you compared against. That rules out a truncated download or a corrupted disk, but it says nothing about whether the source itself was trustworthy: if an attacker replaced the file and the checksum on the same page, both will agree. For authenticity you need a signature — a GPG-signed SHA256SUMS file, for instance — verified against a key you obtained separately.